BlockStrap: Critical Magento Flaw Needs a Manual Patch

A maximum-severity flaw in Magento and Adobe Commerce, tracked as CVE-2026-103849 and nicknamed BlockStrap, could let an unauthenticated attacker run arbitrary PHP code on a store’s server. Adobe published its fix on October 13 in bulletin APSB26-153, but rated it “priority 2,” which under Adobe’s scheme means patch within 30 days. The security firm Sansec, which named the flaw, says that rating understates the urgency.

Sansec has not seen BlockStrap used against live stores yet. It says it reproduced four different attack routes within 24 hours and expects attackers to do the same, noting that anyone with an AI agent can reverse-engineer the patch into a working exploit quickly. BlockStrap is the second break in Magento’s email template engine in about six weeks: the September StyleSmuggler flaw, which we covered, went from a priority 1 hotfix to mass exploitation in three days. BlockStrap is a related “second-pass” template injection: attacker-controlled content in a child email template can be signed and processed again at the root level, where a smuggled {{block}} directive runs inside Magento’s rendering. Sansec says BlockStrap and StyleSmuggler are separate fixes and a store needs both.

How to check if you’re affected

Affected versions are Adobe Commerce and Magento Open Source through 2.4.9, and Adobe Commerce B2B through 1.5.3. Sansec adds that Mage-OS is affected up to version 3.5.0; Mage-OS 3.6.0, released October 14, contains Adobe’s fix.

• A plain Composer install is not enough. Sansec says it still pulls the vulnerable base version, so apply the 2026-oct release or Adobe’s isolated patch.
• Open Source stores on 2.4.7-p10, 2.4.8-p5 and 2.4.9 have public patches. Sansec says patches for 2.4.4-p18, 2.4.5-p17 and 2.4.6-p15 need an Adobe Commerce license, so Open Source stores on 2.4.6 or older must upgrade to 2.4.7-p10 or later. Adobe lists the downloads per version in KB article ka-49323.
• Keep the September StyleSmuggler hotfix (VULN-39341) installed. Sansec says the October patch does not include it, so install it separately, before the October patch.
• To confirm the patch landed, run grep -c resolveDeferredDirectives vendor/magento/framework/Filter/Template.php from the Magento root (on Mage-OS, check vendor/mage-os/framework/Filter/Template.php). A result of 0 means the BlockStrap fix is missing. Sansec advises checking the code even when your deploy reported no errors.
• Sansec says its Shield product blocks BlockStrap at the HTTP layer if you cannot patch within hours, and its eComscan tool flags the missing patch and checks for backdoors. Both are the vendor’s own products.

Sources

• Sansec: BlockStrap: Magento and Adobe Commerce RCE (CVE-2026-103849)
• Adobe security bulletin APSB26-153 (link taken from BleepingComputer’s report; the page refuses automated requests)
• BleepingComputer: Critical BlockStrap flaw lets hackers run code on Magento servers